Resources
Resources
Downloads
Free resources available to everyone — no account required.
- KQL Quick Reference Card — the operators, functions, and patterns used in every investigation (coming with Module 2 launch)
- Sign-In Log Field Reference — every field explained with investigation context (coming with Module 4 launch)
- Investigation Flowcharts — decision trees for common attack scenarios (coming with paid modules)
FAQ
Who is this training for? SOC analysts working in Microsoft 365 environments, IT administrators transitioning into security roles, and MSP technicians responsible for client security. The SC-200 track assumes basic M365 administration familiarity but no prior security experience.
Do I need an M365 tenant to follow along? The free modules (1–4) can be read without any lab environment. For paid modules, we recommend setting up an M365 Business Premium tenant (£18.20/month) for hands-on practice. Each module includes setup instructions.
Is this just exam prep? No. The modules are mapped to SC-200 exam objectives, but the content is investigation-focused. You learn to investigate real attack scenarios — the exam pass is a side effect of knowing the material operationally.
What format is the content? Written content only — no video. Annotated screenshots, KQL code blocks with line-by-line explanation, investigation flowcharts, and downloadable assets. Written content is searchable, bookmarkable, and referenceable during live investigations.
How often is new content published? One new module and one scenario challenge per month after launch.
Can I get a refund? Yes. See our Refund & Cancellation Policy.
Blog
The Ridgeline blog launches alongside the training platform. Topics will include KQL tips, investigation walkthroughs, detection engineering patterns, and Microsoft security product updates.